Law 25 — Governance Policy

Overview

Draft the policy on practices governing the protection of personal information under Quebec Law 25. Covers complaints process, staff roles and responsibilities, retention and destruction rules, and review cycle.

Getting Started

Add your source materials to the project workspace, then activate the Law 25 — Governance Policy skill. The agent will guide you through the process step by step.

Example conversation

You: We need a governance policy for personal information protection under Law 25—complaints process, who does what, and how long we keep data.

Agent: I’ll draft the policy on practices governing the protection of personal information using the Law 25 reference and template. I’ll include: a short commitment and accountability statement, a complaints process (how to submit, how we respond, and that individuals may contact the CAI), roles and responsibilities (Privacy Officer and staff who handle personal information), retention and destruction rules, and a review cycle. You can adapt the wording to your size and activities.

Output excerpt

Policy on practices (excerpt)
2. Complaints process
Individuals may file a complaint regarding the protection of their personal information by: Contact: privacy@example.qc.ca or [form link]. Process: We will acknowledge within 5 business days and respond within 30 days. Individuals may also contact the Commission d’accès à l’information du Québec (CAI).

4. Retention and destruction
Personal information is retained only for as long as necessary for the purposes for which it was collected or as required by law. When no longer needed, it is securely destroyed or anonymized in accordance with our internal procedures.

References and resources

• references/law25-governance-requirements.md — Law 25 obligation (effective September 2023); complaints process; staff roles and responsibilities; retention and destruction; privacy-by-design.
• assets/template_governance_policy_law25.md — Optional structure for the governance policy (intro, complaints, roles, retention/destruction, updates).
  This skill does not include an extension tool; the agent uses the reference and template to produce the governance policy. For validation of related documents (e.g. privacy policy, Privacy Officer designation), use the other Law 25 skills.